Customer-hosted execution

Run tests in your environment.

Use the managed portal while an approved collector and test runner operate within your cloud boundary.

Deployment design · implementation by agreement

This is the intended operating model, not a self-service installer. The collector, private connectivity, runner and acceptance evidence must be agreed and verified for your environment.

The customer controls the execution boundaryArrows show the workflow, not inbound network access. A local runner initiates approved outbound coordination. Only an agreed summary reaches the managed portal; source credentials and raw customer data stay local.
  1. Your environmentSource accountsSelected AWS resources and customer-owned read roles.
  2. Your environmentLocal collectorInspect configuration; preview and approve exported metadata.
  3. PortabilityLabsManaged portalWorkload definition, approved metadata and test coordination.
  4. Your environmentIsolated targetLocal runner executes an approved package with bounded access.

Credentials

The source-read role, target-deploy role and test application identity are separate. The runner receives only the permissions required for the declared target. Product-wide or account-wide access is not an acceptable shortcut.

Evidence

Raw logs, payloads, files and source credentials stay within the approved boundary. Agree exactly which outcomes, hashes, timestamps and cleanup records may be exported.

Inspection and teardown

Agree a short review window, an expiry, a visible teardown action and independent cleanup checks. Your organisation pays its own cloud infrastructure costs while resources run.

What we agree before deployment

  • Source accounts, target accounts, networks and regions.
  • Permitted application material, test data and outbound destinations.
  • Runner installation, temporary roles, proxy/private connectivity and revocation.
  • Capacity, maximum runtime, review window, budgets and teardown ownership.
  • Evidence fields, retention, access and a tested recovery process.
  • Which portability outcomes and isolation checks must pass for acceptance.

If the portal and evidence must also stay inside your estate, use the sovereign design.

Discuss a customer-hosted evaluation.

Start with one representative workload and the boundary your security team needs to enforce.

Request early access →